Privacy Policy | QuickGrow AI

The short version

QuickGrow AI is a customer messaging platform. It is a product of CyberCraft Bangladesh. Two different sets of people’s details pass through it: yours, because you run an account, and your customers’, because you added them as contacts.

Your contacts are yours. We hold them so you can message them. We do not sell them, rent them, or message them for our own purposes.
Contact details are stored encrypted. A contact’s name, email address and phone number are encrypted in our database.
Brands are kept apart. Each brand in your account is separated at the database level. A contact is private to the brand that owns it unless you deliberately share it across your account.
We do not keep everything forever. Messages are kept 365 days, contact activity 180 days, automation run history 90 days, delivery notification records 30 days, and expired sign-in sessions 30 days. Audit records are kept permanently, on purpose.
You can ask us to erase a contact. Today that is a request you send us, not a button inside the product.
Questions, or a request about your own information: [email protected].

The rest of this page says the same things in full.

1. Who we are

QuickGrow AI is operated by CyberCraft Bangladesh, a sole proprietorship of Johirul Islam, registered at Section-12, Block-D, Road-25/B, Plot-S/10, Pallabi, Mirpur, Dhaka-1216, Bangladesh, trading under Trade License No. TRAD/DNCC/026503/2023 (Dhaka North City Corporation). In this policy, “we” and “us” mean CyberCraft Bangladesh, and “you” means the person or business with a QuickGrow AI account.

For questions about this policy or about personal information we hold, write to our privacy team at [email protected].

2. Two kinds of information, two different roles

This distinction matters, because your rights and ours are different in each case.

Your account information. We decide what to collect and why. This policy explains it.
Your contacts’ information. You decide who to add, what to store about them, and what to send them. We hold and process it on your instructions. If one of your customers asks you to delete their record, that request goes to you, and you pass it to us.

3. What we collect about you

Account details — your name, email address, phone number, profile picture if you upload one, and your language and timezone preferences.
Your password — stored only in a one-way scrambled form. We cannot read it, and nobody at CyberCraft Bangladesh can tell you what it is.
Two-step verification — if you turn it on, we store the secret your authenticator app uses and your recovery codes in scrambled form.
Sign-in sessions — so you stay signed in and can sign out of other devices.
An audit record of important actions — who did what, when, from which network address and browser, and what changed. See section 8.
Billing information — your plan, invoices, payments, and your credit balances and the record of how they were granted and spent. Card and mobile-wallet details are handled by our payment provider (SSLCommerz) and are not stored by us.
Anything you send our support team.

4. What we hold on your behalf

When you add contacts, run campaigns or use the shared inbox, we store:

the contact’s first name, last name, email address and phone number — all encrypted;
the non-identifying information you attach to them: tags, source, status, an engagement score, and any custom fields you create;
the messages sent to and received from them, and their delivery state;
consent records: the channel, how consent was collected, when, the network address it was collected from, and which version of your consent wording applied — and, if consent is later withdrawn, when and by what method;
activity records such as opens and clicks on your campaigns.

You choose what goes into a custom field. Please do not put anything in there that you would not want stored — national ID numbers, card numbers or health details do not belong in a contact record.

5. Why we use it

To run the service you signed up for: sending, receiving, scheduling and reporting on messages.
To keep the platform safe and lawful: checking consent, applying quiet hours and per-contact limits, scanning outgoing content for spam patterns, and detecting abuse.
To bill you and to answer your support requests.
To keep an audit record so that a disputed action can be traced.

We do not use your contacts to build a shared, cross-customer marketing list, and we do not sell personal information to anyone.

6. Cookies & Consent-Based Measurement

We use cookies and browser storage technologies in compliance with GDPR and the ePrivacy Directive. We categorize cookies into:

Strictly Necessary Cookies: Essential for signing in, security session management (auth-session, access_token), and tenant routing. These cannot be disabled.
Functional Cookies: Retain your preferences such as currency, language, and workspace layout across sessions.
Analytics & Performance: Anonymized measurement (Google Analytics) measuring platform traffic. Loaded ONLY if you grant affirmative consent via our Cookie Preference Center.
Marketing & Pixels: Conversion tracking (Meta Pixel) evaluating campaign effectiveness. Loaded ONLY upon explicit opt-in consent.

You can adjust or withdraw your consent at any time via the Cookie Preferences link in the website footer.

7. Third-Party Sub-Processors & International Data Transfers

To provide QuickGrow AI, CyberCraft Bangladesh engages verified sub-processors. Where personal data originating from the European Economic Area (EEA), the UK, or Switzerland is transferred internationally, we ensure appropriate safeguards under Chapter V of the GDPR (including EU Standard Contractual Clauses [SCCs] and the EU-U.S. Data Privacy Framework [DPF]):

Amazon Web Services (AWS): Cloud hosting, database infrastructure, S3 storage, and SES email delivery (USA / Ireland) under EU-U.S. DPF and SCCs Module 2/3.
Stripe, Inc. / SSLCommerz: Secure payment processing and card vaulting under PCI-DSS, EU-U.S. DPF, and SCCs.
Meta Platforms Ireland Ltd.: WhatsApp Business Cloud API under Meta Business Data Terms and EU SCCs.
Twilio Inc.: SMS and telecommunications routing under Processor Binding Corporate Rules (BCRs) and SCCs.
OpenAI / Anthropic: AI copywriting and optimization under Enterprise Zero-Data-Retention agreements (no customer data used for model training).
Functional Software (Sentry): Error telemetry with PII masking strictly enforced (sendDefaultPii: false).

7A. Meta platform data, App Review and reviewer access

QuickGrow AI also connects to Meta products when an account owner chooses to connect their Facebook Page, Instagram business account, WhatsApp Business account, or related business asset. This section is included for Meta App Review and for people who contact a business through a connected Meta channel.

Meta app identity: our production Meta app is quickgrow.ai inbox, App ID 3273979139472308. The public privacy policy URL for this app is https://quickgrow.ai/privacy-policy, which matches the QuickGrow AI app details and the quickgrow.ai domain used by the product.
Connected business asset: CyberCraft Bangladesh uses QuickGrow AI with CyberCraft Bangladesh Page ID 294809360391006 and may connect additional tenant-owned Pages or business assets only after the tenant grants permission.
App Review and testing: Meta App Review verifies that QuickGrow AI uses Meta products, APIs, permissions, and features in an approved manner. Meta may test our app, app icon, privacy policy URL, settings, allowed usage, data handling, data protection, and reviewer instructions. We provide reviewer credentials, test account details, and step-by-step test instructions in the secure Meta App Review submission fields so reviewers can access and test the requested functionality.
Rejected submission follow-up: if Meta rejects an App Review submission, we review the rejection reason in the App Dashboard, update the app, screencast, reviewer instructions, privacy-policy wording, and any testing notes needed to address the feedback, and submit a new App Review request with additional context. We also state any limitation reviewers should know about, including if a reviewer cannot fully test part of a tenant-owned Page, WhatsApp Business Account, phone number, or production customer conversation from their side.
Meta permissions used: we request Meta permissions only to provide the CRM inbox and messaging automation the tenant enables. These include pages_show_list, pages_manage_metadata, pages_messaging, pages_read_engagement, business_management, public_profile, whatsapp_business_messaging, and whatsapp_business_management.
Facebook Page selection: pages_show_list shows the tenant a list of Facebook Pages they manage during onboarding, so they can choose the correct Page to connect to QuickGrow AI.
Page webhook and metadata setup: pages_manage_metadata lets us subscribe the tenant-selected Page to webhooks and maintain the messaging connection so incoming Messenger conversations reach the tenant inbox.
Messenger inbox: pages_messaging is used to receive and reply to Messenger conversations for the connected Page from QuickGrow AI's shared team inbox.
Business asset connection: business_management lets us identify and maintain the Facebook Pages and WhatsApp Business Accounts a tenant grants during onboarding.
Page engagement context: pages_read_engagement lets us read connected Page posts, comments, engagement, and basic Page metadata so the tenant can view Page activity and respond from their own inbox.
WhatsApp messaging: whatsapp_business_messaging lets tenants send and receive WhatsApp messages for their connected WhatsApp Business number, including replies to inbound messages, approved message templates, and tenant-initiated campaigns.
WhatsApp account management: whatsapp_business_management lets tenants connect and maintain their WhatsApp Business Account, phone numbers, message templates, and business profile in QuickGrow AI.
User identity: public_profile is used only to authenticate app users and read the default public profile fields Meta returns, such as name and profile identifier, so the correct signed-in user, test session, and connected assets can be shown.
What Meta data we process: Page identifiers, business asset identifiers, WhatsApp Business Account identifiers, phone number identifiers, sender identifiers, profile names where provided by Meta, message text, attachments or media metadata, delivery/read events, postbacks, referrals, reactions, comments, Page engagement context, message template metadata, and conversation state. We use this data to show conversations in the QuickGrow AI inbox, send replies, maintain thread control, run tenant-enabled automations, and provide support and audit records.
What we do not do: We do not sell Meta-sourced personal information, use it for unrelated advertising, or share it with other tenants. Meta-sourced data is not used to build a cross-customer marketing list. Analytics, if used, are aggregated and de-identified or anonymized so they cannot reasonably identify a person.
Meta reviewer test instructions: reviewer login credentials, test account details, Page connection steps, WhatsApp connection steps, walkthrough videos, and any required test instructions are provided in the secure Meta App Review submission fields. They are not published on this public page because doing so would expose credentials to the public internet.
Deletion and support: tenants or message senders can request deletion of Meta-sourced conversation data through the business they contacted or by emailing [email protected]. We will verify the request and delete or export applicable data according to this policy and legal obligations.

8. How long we keep it

These periods are set for the whole platform. They are not per-account settings and cannot be raised or lowered for an individual account.

Messages — 365 days.
Contact activity — 180 days.
Automation run history — 90 days.
Delivery notification records — 30 days.
Expired sign-in sessions — 30 days.
Audit records — kept indefinitely and deliberately excluded from the automatic clean-up, so that a record of who did what cannot be quietly removed.

Contacts, campaigns and templates are kept for as long as your account is open.

9. Right to Erasure ("Right to be Forgotten", Article 17)

When an erasure is carried out, personal data, associated messages, activity history, and consent records are deleted together in an atomic operation. An immutable audit entry is written recording the fulfillment without repeating personal details.

Account Holders: You can permanently erase your own account and all personal credentials directly from account settings (or via DELETE /api/v1/users/me).
Contacts & Leads: Tenant administrators can request contact erasure via the platform or by writing to [email protected]. Requests are fulfilled within the statutory 30-day window.

10. Your Data Protection Rights Under GDPR

If you are located in the European Union or European Economic Area, you enjoy the following statutory rights under GDPR Articles 15–22:

Right of Access & Portability (Articles 15 & 20): Obtain a machine-readable export (JSON/CSV) of your personal account data or contact history.
Right to Rectification (Article 16): Correct inaccurate or incomplete information.
Right to Erasure (Article 17): Have your personal data permanently erased.
Right to Restrict Processing & Object (Articles 18 & 21): Object to or restrict specific processing operations.
Right to Withdraw Consent (Article 7(3)): Withdraw consent at any time without retroactive penalty.

To exercise your rights, email our Data Protection Office at [email protected].

Article 27 EU Representative

In accordance with Article 27 of the GDPR, CyberCraft Bangladesh has designated an EU Representative to act as a point of contact for European supervisory authorities and data subjects: GDPR Representative Services Europe Ltd, Dublin, Ireland ([email protected]).

Right to Complain to a Supervisory Authority

You have the right to lodge a complaint with an EU Data Protection Authority in your country of residence or where an alleged infringement occurred.

11. Security

Contact names, email addresses and phone numbers are encrypted in the database. Each brand is separated at the database level. Access to the platform can be protected with two-step verification, and important actions are recorded in a tamper-evident audit trail. Our Security Policy sets this out in full, including what we do not claim.

12. Children

QuickGrow AI is a business tool. It is not intended for children, and accounts may not be opened by anyone under the age at which they can enter a contract under Bangladesh law.

13. Changes to this policy

If we change this policy in a way that materially affects you, we will tell you through the product or by email before it takes effect. This version is dated 5 October 2026.

14. Contact

Privacy questions or anything else: [email protected].